CVE-2024-22409: Default Privileges allow for high level operations for low privileged users in datahub
First published: Tue Jan 16 2024(Updated: )
DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile information. The default privileges gave too many broad permissions to low privileged users. These have been constrained in PR #9067 to prevent abuse. This issue can result in privilege escalation for lower privileged users up to admin privileges, potentially, if a group with admin privileges exists. May not impact instances that have modified default privileges. This issue has been addressed in datahub version 0.12.1. Users are advised to upgrade.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Datahub | <0.12.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-22409?
CVE-2024-22409 is categorized as a low severity vulnerability.
How do I fix CVE-2024-22409?
To mitigate CVE-2024-22409, upgrade DataHub to version 0.12.1 or higher to restrict user permissions.
What are the risks associated with CVE-2024-22409?
The risks associated with CVE-2024-22409 include unauthorized user removals and alterations to group memberships and profile information.
Who is affected by CVE-2024-22409?
Users of DataHub versions below 0.12.1 are affected by CVE-2024-22409.
What changes were made to address CVE-2024-22409?
CVE-2024-22409 addressed the issue of overly broad permissions granted to low privileged users.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- agent/remedy
- agent/severity
- agent/softwarecombine
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/datahub project
- canonical/datahub